[SPKM] SPKM Design Team Meeting Notes

On 1/16/2007, the SPKM design team Larry Zhu, Nicolas Williams and Olga
Kornievskaia had a conf call that was aimed to produce a comparison of
PkU2U and the TLS mechanism for the community so the community can
decide between them.

Here is the list of things that came up:

PKU2U has a draft,  hence the description is omitted here.

PKU2U Pros:

----------

1) Kerberos alike, easy to implement for folks who already have a PKINIT
and a Kerberos implementation

2) one less round trip per handle-shake

PKU2U Cons:

----------

1) not easier than TLS approach for folks who do not have a PKINIT
implementation

2) this is a new mechanism

TLS approach currently does not have a draft. Here is a brief
description: at high level, it can be based on TLS or Datagram TLS. And
per-message tokens are based on RFC4121, in the same way how PKU2U
per-message tokens work.

TLS approach Pros:

-----------------

1) this is based on an existing mechanism that is mature

2) this is the single mechanism for certificate-based peer to peer
authentication mechanism.

3) open source TLS implementations are available

TLS approach Cons:

------------------

1)at least 2 extra messages (one extra roundtrip) per handshake

The design team discussed the differences in encoding of the
context-establishment tokens employed by these two approaches, and did
not believe the differences are significant to make one preferable over
the other.

Olga raised objections to PKU2U on the ground it is dependent on
Kerberos. She also considered the PKU2U ID underspecified and
significant work need to be done to wrap up PKU2U.

The design team acknowledged that common problems exist such as GSS-API
naming based on distinguished names, channel bindings, certificate
selections, and credentials managements.

--Larry